PT-2019-2041 · Cisco · Cisco Asa+1

CVE-2019-1708 · Publicado 2019-05-01 · Atualizado 2023-08-15

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device, leading to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Improper Resource Release

Enumeração de Fraquezas

CWE-401

CWE-404

Identificadores relacionados

BDU:2019-01786

CVE-2019-1708

Produtos afetados

Cisco Asa

Cisco Ftd

Referências · 6

• https://t.me/cvenotify/56507 · Publicação no Telegram
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-ike-dos · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1708 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1708 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01786 · Nota de Segurança
• http://securityfocus.com/bid/108166 · Nota